wannacry | 2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec | Triage

Sharing

General

Target

2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
Size

2.2MB
Sample

240713-lbkcesxdpf
MD5

da8dde3005365992711946c4622a3c74
SHA1

d04042cd11cd11f3b6386a5e2275f14b92048fc6
SHA256

2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec
SHA512

a06f8a53e5cd7e80429c2d7339f0c7d78a1d384da2fccb23a0cee5c7e9f39dbe3e73bac0ee271b84f3cfa8a545a57bcf592446666b6381397df20beb644a77e7
SSDEEP

49152:QnaMSPbcBVQej/1INMx+TSqTdX1H76SAARdhn:QaPoBhz1aMxcSUD76SAEdh

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Targets

- Target
  
  2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec.exe
- Size
  
  2.2MB
- MD5
  
  da8dde3005365992711946c4622a3c74
- SHA1
  
  d04042cd11cd11f3b6386a5e2275f14b92048fc6
- SHA256
  
  2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec
- SHA512
  
  a06f8a53e5cd7e80429c2d7339f0c7d78a1d384da2fccb23a0cee5c7e9f39dbe3e73bac0ee271b84f3cfa8a545a57bcf592446666b6381397df20beb644a77e7
- SSDEEP
  
  49152:QnaMSPbcBVQej/1INMx+TSqTdX1H76SAARdhn:QaPoBhz1aMxcSUD76SAEdh
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Contacts a large (2137) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

wannacrydiscoveryransomwareworm

behavioral2

wannacrydiscoveryransomwareworm